summaryrefslogtreecommitdiffstats
path: root/sys/security/mac/mac_vfs.c
Commit message (Collapse)AuthorAgeFilesLines
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hrwatson2006-10-221-0/+1
| | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA
* Remove MAC_DEBUG label counters, which were used to debug leaks andrwatson2006-09-201-25/+0
| | | | | | | | | other problems while labels were first being added to various kernel objects. They have outlived their usefulness. MFC after: 1 month Suggested by: Christopher dot Vance at SPARTA dot com Obtained from: TrustedBSD Project
* Remove the NDEVFSINO and NDEVFSOVERFLOW options which no longer exists inphk2006-07-171-1/+0
| | | | | | DEVFS. Remove the opt_devfs.h file now that it is empty.
* Introduce a new MAC entry point for label initialization of the NFS daemon'scsjp2006-04-061-0/+7
| | | | | | | | | | | | | | | credential: mac_associate_nfsd_label() This entry point can be utilized by various Mandatory Access Control policies so they can properly initialize the label of files which get created as a result of an NFS operation. This work will be useful for fixing kernel panics associated with accessing un-initialized or invalid vnode labels. The implementation of these entry points will come shortly. Obtained from: TrustedBSD Requested by: mdodd MFC after: 3 weeks
* Remove mac_create_root_mount() and mpo_create_root_mount(), whichrwatson2005-09-191-8/+0
| | | | | | | | | | | | | | | | | provided access to the root file system before the start of the init process. This was used briefly by SEBSD before it knew about preloading data in the loader, and using that method to gain access to data earlier results in fewer inconsistencies in the approach. Policy modules still have access to the root file system creation event through the mac_create_mount() entry point. Removed now, and will be removed from RELENG_6, in order to gain third party policy dependencies on the entry point for the lifetime of the 6.x branch. MFC after: 3 days Submitted by: Chris Vance <Christopher dot Vance at SPARTA dot com> Sponsored by: SPARTA
* When devfs cloning takes place, provide access to the credential of therwatson2005-07-141-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | process that caused the clone event to take place for the device driver creating the device. This allows cloned device drivers to adapt the device node based on security aspects of the process, such as the uid, gid, and MAC label. - Add a cred reference to struct cdev, so that when a device node is instantiated as a vnode, the cloning credential can be exposed to MAC. - Add make_dev_cred(), a version of make_dev() that additionally accepts the credential to stick in the struct cdev. Implement it and make_dev() in terms of a back-end make_dev_credv(). - Add a new event handler, dev_clone_cred, which can be registered to receive the credential instead of dev_clone, if desired. - Modify the MAC entry point mac_create_devfs_device() to accept an optional credential pointer (may be NULL), so that MAC policies can inspect and act on the label or other elements of the credential when initializing the skeleton device protections. - Modify tty_pty.c to register clone_dev_cred and invoke make_dev_cred(), so that the pty clone credential is exposed to the MAC Framework. While currently primarily focussed on MAC policies, this change is also a prerequisite for changes to allow ptys to be instantiated with the UID of the process looking up the pty. This requires further changes to the pty driver -- in particular, to immediately recycle pty nodes on last close so that the credential-related state can be recreated on next lookup. Submitted by: Andrew Reisse <andrew.reisse@sparta.com> Obtained from: TrustedBSD Project Sponsored by: SPAWAR, SPARTA MFC after: 1 week MFC note: Merge to 6.x, but not 5.x for ABI reasons
* Move MAC check_vnode_mmap entry point out from being exclusive tocsjp2005-04-141-2/+3
| | | | | | | | | | | | | | | | | | | | MAP_SHARED so that the entry point gets executed un-conditionally. This may be useful for security policies which want to perform access control checks around run-time linking. -add the mmap(2) flags argument to the check_vnode_mmap entry point so that we can make access control decisions based on the type of mapped object. -update any dependent API around this parameter addition such as function prototype modifications, entry point parameter additions and the inclusion of sys/mman.h header file. -Change the MLS, BIBA and LOMAC security policies so that subject domination routines are not executed unless the type of mapping is shared. This is done to maintain compatibility between the old vm_mmap_vnode(9) and these policies. Reviewed by: rwatson MFC after: 1 month
* Update copyright for NETA->McAfee.rwatson2005-01-301-5/+5
|
* Do the dreaded s/dev_t/struct cdev */phk2004-06-161-1/+1
| | | | Bump __FreeBSD_version accordingly.
* Update my personal copyrights and NETA copyrights in the kernelrwatson2004-02-221-2/+2
| | | | | | | | to use the "year1-year3" format, as opposed to "year1, year2, year3". This seems to make lawyers more happy, but also prevents the lines from getting excessively long as the years start to add up. Suggested by: imp
* Modify the MAC Framework so that instead of embedding a (struct label)rwatson2003-11-121-83/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Remove the flags argument from mac_externalize_*_label(), as it's notrwatson2003-11-061-1/+1
| | | | | | | passed into policies or used internally to the MAC Framework. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Make MAC_EXTERNALIZE() and MAC_INTERNALIZE() simply take the objectrwatson2003-10-251-2/+2
| | | | | | | | | type, rather than "object_label" as the first argument. This reduces complexity a little for the consumer, and also makes it easier for use to rename the underlying entry points in struct mac_policy_obj. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Remove non-VFS related code from mac_vfs.c. Leave:rwatson2003-10-221-2987/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* If the struct mac copied into the kernel has a negative length, returnrwatson2003-09-291-1/+2
| | | | | EINVAL rather than failing the following malloc due to the value being too large.
* Fix a mac_policy_list reference to be a mac_static_policy_listrwatson2003-08-261-1/+1
| | | | | | | | reference: this fixes mac_syscall() for static policies when using optimized locking. Obtained from: TrustedBSD Project Sponosred by: DARPA, Network Associates Laboratories
* Introduce two new MAC Framework and MAC policy entry points:rwatson2003-08-211-0/+19
| | | | | | | | | | | | | | mac_reflect_mbuf_icmp() mac_reflect_mbuf_tcp() These entry points permit MAC policies to do "update in place" changes to the labels on ICMP and TCP mbuf headers when an ICMP or TCP response is generated to a packet outside of the context of an existing socket. For example, in respond to a ping or a RST packet to a SYN on a closed port. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add mac_check_vnode_deleteextattr() and mac_check_vnode_listextattr():rwatson2003-08-211-0/+32
| | | | | | | | | | | explicit access control checks to delete and list extended attributes on a vnode, rather than implicitly combining with the setextattr and getextattr checks. This reflects EA API changes in the kernel made recently, including the move to explicit VOP's for both of these operations. Obtained from: TrustedBSD PRoject Sponsored by: DARPA, Network Associates Laboratories
* Remove about 40 lines of #ifdef/#endif by using new macrosrwatson2003-08-201-70/+31
| | | | | | | | | MAC_DEBUG_COUNTER_INC() and MAC_DEBUG_COUNTER_DEC() to maintain debugging counter values rather than #ifdef'ing the atomic operations to MAC_DEBUG. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Attempt to simplify #ifdef logic for MAC_ALWAYS_LABEL_MBUF.rwatson2003-08-011-28/+18
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Redesign the externalization APIs from the MAC Framework torwatson2003-06-231-40/+20
| | | | | | | | | | | | | | | | | | | | | | | | | the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add a f_vnode field to struct file.phk2003-06-221-2/+2
| | | | | | | | | | | | Several of the subtypes have an associated vnode which is used for stuff like the f*() functions. By giving the vnode a speparate field, a number of checks for the specific subtype can be replaced simply with a check for f_vnode != NULL, and we can later free f_data up to subtype specific use. At this point in time, f_data still points to the vnode, so any code I might have overlooked will still work.
* Use __FBSDID().obrien2003-06-111-4/+4
|
* Rename MAC_MAX_POLICIES to MAC_MAX_SLOTS, since the variables andrwatson2003-05-081-8/+8
| | | | | | | | | | | | constants in question refer to the number of label slots, not the maximum number of policies that may be loaded. This should reduce confusion regarding an element in the MAC sysctl MIB, as well as make it more clear what the affect of changing the compile-time constants is. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Clean up locking for the MAC Framework:rwatson2003-05-071-78/+180
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* - Acquire the vm_object's lock when performing vm_object_page_clean().alc2003-04-241-0/+2
| | | | | | - Add a parameter to vm_pageout_flush() that tells vm_pageout_flush() whether its caller has locked the vm_object. (This is a temporary measure to bootstrap vm_object locking.)
* Update NAI copyright to 2003, missed in earlier commits and merges.rwatson2003-04-181-1/+1
|
* mac_init_mbuf_tag() accepts malloc flags, not mbuf allocator flags, sorwatson2003-04-151-3/+2
| | | | | | | | don't try and convert the argument flags to malloc flags, or we risk implicitly requesting blocking and generating witness warnings. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Move MAC label storage for mbufs into m_tags from the m_pkthdr structure,rwatson2003-04-141-17/+118
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Abstract access to the mbuf header label behind a new function,rwatson2003-04-141-25/+80
| | | | | | | | | | mbuf_to_label(). This permits the vast majority of entry point code to be unaware that labels are stored in m->m_pkthdr.label, such that we can experiment storage of labels elsewhere (such as in m_tags). Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Introduce an M_ASSERTPKTHDR() macro which performs the very common taskdes2003-04-081-2/+2
| | | | | | | of asserting that an mbuf has a packet header. Use it instead of hand- rolled versions wherever applicable. Submitted by: Hiten Pandya <hiten@unixdaemons.com>
* Modify the mac_init_ipq() MAC Framework entry point to accept anrwatson2003-03-261-4/+12
| | | | | | | | | | | | | additional flags argument to indicate blocking disposition, and pass in M_NOWAIT from the IP reassembly code to indicate that blocking is not OK when labeling a new IP fragment reassembly queue. This should eliminate some of the WITNESS warnings that have started popping up since fine-grained IP stack locking started going in; if memory allocation fails, the creation of the fragment queue will be aborted. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Instrument sysarch() MD privileged I/O access interfaces with a MACrwatson2003-03-061-0/+12
| | | | | | | | | | | check, mac_check_sysarch_ioperm(), permitting MAC security policy modules to control access to these interfaces. Currently, they protect access to IOPL on i386, and setting HAE on Alpha. Additional checks might be required on other platforms to prevent bypass of kernel security protections by unauthorized processes. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Provide a mac_check_system_swapoff() entry point, which permits MACrwatson2003-03-051-0/+14
| | | | | | | modules to authorize disabling of swap against a particular vnode. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Replace calls to WITNESS_SLEEP() and witness_list() with equivalent callsjhb2003-03-041-2/+3
| | | | to WITNESS_WARN().
* Back out M_* changes, per decision of the TRB.imp2003-02-191-34/+34
| | | | Approved by: trb
* Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.alfred2003-01-211-34/+34
| | | | Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT.
* Bow to the whining masses and change a union back into void *. Retaindillon2003-01-131-4/+4
| | | | | removal of unnecessary casts and throw in some minor cleanups to see if anyone complains, just for the hell of it.
* Change struct file f_data to un_data, a union of the correct structdillon2003-01-121-4/+4
| | | | | | | | | | pointer types, and remove a huge number of casts from code using it. Change struct xfile xf_data to xun_data (ABI is still compatible). If we need to add a #define for f_data and xf_data we can, but I don't think it will be necessary. There are no operational changes in this commit.
* SCARGS removal take II.alfred2002-12-141-5/+5
|
* Backout removal SCARGS, the code freeze is only "selectively" over.alfred2002-12-131-5/+5
|
* Remove SCARGS.alfred2002-12-131-5/+5
| | | | Reviewed by: md5
* Remove dm_root entry from struct devfs_mount. It's never set, and isrwatson2002-12-091-9/+11
| | | | | | | | | | | | unused. Replace it with a dm_mount back-pointer to the struct mount that the devfs_mount is associated with. Export that pointer to MAC Framework entry points, where all current policies don't use the pointer. This permits the SEBSD port of SELinux's FLASK/TE to compile out-of-the-box on 5.0-CURRENT with full file system labeling support. Approved by: re (murray) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Un-staticize mac_cred_mmapped_drop_perms() so that it may be usedrwatson2002-11-261-1/+1
| | | | | | | | | by policy modules making use of downgrades in the MAC AST event. This is required by the mac_lomac port of LOMAC to the MAC Framework. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Introduce p_label, extensible security label storage for the MAC frameworkrwatson2002-11-201-1/+25
| | | | | | | | | | | | | | | | | | | in struct proc. While the process label is actually stored in the struct ucred pointed to by p_ucred, there is a need for transient storage that may be used when asynchronous (deferred) updates need to be performed on the "real" label for locking reasons. Unlike other label storage, this label has no locking semantics, relying on policies to provide their own protection for the label contents, meaning that a policy leaf mutex may be used, avoiding lock order issues. This permits policies that act based on historical process behavior (such as audit policies, the MAC Framework port of LOMAC, etc) can update process properties even when many existing locks are held without violating the lock order. No currently committed policies implement use of this label storage. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Merge kld access control checks from the MAC tree: these access controlrwatson2002-11-191-0/+46
| | | | | | | | | | | checks permit policy modules to augment the system policy for permitting kld operations. This permits policies to limit access to kld operations based on credential (and other) properties, as well as to perform checks on the kld being loaded (integrity, etc). Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Introduce a condition variable to avoid returning EBUSY whenrwatson2002-11-131-29/+52
| | | | | | | | | | | | | the MAC policy list is busy during a load or unload attempt. We assert no locks held during the cv wait, meaning we should be fairly deadlock-safe. Because of the cv model and busy count, it's possible for a cv waiter waiting for exclusive access to the policy list to be starved by active and long-lived access control/labeling events. For now, we accept that as a necessary tradeoff. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Garbage collect mac_create_devfs_vnode() -- it hasn't been used sincerwatson2002-11-121-7/+0
| | | | | | | | we brought in the new cache and locking model for vnode labels. We now rely on mac_associate_devfs_vnode(). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Garbage collect definition of M_MACOPVEC -- we no longer perform arwatson2002-11-111-2/+0
| | | | | | | | dynamic mapping of an operation vector into an operation structure, rather, we rely on C99 sparse structure initialization. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add an explicit execlabel argument to exec-related MAC policy entryrwatson2002-11-081-3/+4
| | | | | | | | | points, rather than relying on policies to grub around in the image activator instance structure. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
OpenPOWER on IntegriCloud